A multi-channel based data security transmission method and system

Abstract

The application discloses a kind of based on multi-channel data security transmission method and system, the total encryption key pool preposition in the sending end participating in the method and the total decryption key pool preposition in receiving end are identical, sending end and receiving end are respectively provided with multiple one-to-one sending channel and receiving channel, the method includes: sending end obtains the transmission capacity of each of multiple sending channels;According to the transmission capacity of each sending channel, the data to be sent is split into multiple data blocks;According to the size of each data block, obtain multiple encryption keys;Sending end generates multiple transmission data;Multiple transmission data is sent to receiving end;Receiving end receives and verifies multiple transmission data;And after verification, receiving end restores the data to be sent based on multiple transmission data.The application uses one-time pad encryption technology to ensure the security of data during transmission, and the receiver verifies to ensure the integrity of the received data.

Description

Technical Field

[0001] The present application relates to the field of data communication technology, and in particular to a multi-channel based data security transmission method and system. Background Art

[0002] With the development of communication technology, the data content of communication is getting larger and larger. In order to transmit data faster, multi-channel communication technology has emerged with the development of technology. A multi-channel link is a data communication system that uses a logical link composed of multiple physical channels to transmit data.

[0003] While data communications have a widespread application base, data transmission security remains a thorny issue, particularly in certain industries. If data is intercepted or leaked during communication, significant losses can result. In most applications, people expect information to be transmitted securely and confidentially from sender to receiver, without the threat of interception or even complete interception, which could lead to losses. To ensure confidentiality during data transmission, encryption technology has advanced significantly, allowing users to ensure data security during transmission by transmitting encrypted data.

[0004] At present, how to make the process of transmitting encrypted data more secure and faster has always been a technical issue of concern to the industry. Summary of the Invention

[0005] Purpose of the Invention: To address the technical issues raised in the background art, this application provides a multi-channel data security transmission method and system. This application uses one-time pad encryption technology to ensure the security of data during transmission, and the receiver verifies the integrity of the received data.

[0006] Technical Solution: This application proposes a multi-channel data security transmission method. The total encryption key pool preset in the sending end and the total decryption key pool preset in the receiving end participating in the data security transmission method are the same. The sending end is provided with multiple sending channels, and the receiving end is provided with multiple receiving channels. The multiple sending channels correspond to the multiple receiving channels one by one. The method includes:

[0007] The transmitting end obtains the transmission capability of each of the plurality of transmitting channels;

[0008] The transmitting end divides the to-be-transmitted data into a plurality of data blocks according to the transmission capability of each transmission channel, wherein the size of each of the plurality of data blocks corresponds to the transmission capability of each of the plurality of transmission channels;

[0009] The sending end obtains a plurality of encryption keys from the total encryption key pool according to the size of each data block, each of the plurality of encryption keys having a length equal to the size of the corresponding each data block;

[0010] The sending end encrypts each data block using the plurality of encryption keys to generate a plurality of transmission data;

[0011] The sending end sends the plurality of transmission data to the receiving end via the plurality of sending channels;

[0012] The receiving end receives and verifies the plurality of transmission data; and

[0013] After verification, the receiving end restores the data to be sent based on the plurality of transmission data.

[0014] Further, the transmission data is data having a data encoding format, and the data encoding format includes: a sending channel number, a data block number, a data block size, key information, ciphertext payload, and a check value.

[0015] Further, the plurality of data blocks includes a first data block, and the plurality of encryption keys includes a first encryption key for encrypting the first data block, and the process of generating transmission data by the sending end includes:

[0016] The sending end records the sending channel number as the basis for splitting the first data block, the size of the first data block, and the encryption key information of the first encryption key;

[0017] The sending end generates the data block number of the first data block according to the position of the first data block in the data to be sent; and

[0018] The sending end calculates the check value.

[0019] Further, the process of calculating the check value by the sending end includes:

[0020] The sending end concatenates the data block number of the first data block, the size of the first data block, the encryption key information of the first encryption key, and the content of the first data block into a first file;

[0021] The sending end calculates the length of the first file;

[0022] The sending end obtains a check key of the same length from the total encryption key pool according to the length of the first file; and

[0023] The sending end performs an exclusive OR operation on the check key and the first file to obtain the check value.

[0024] Furthermore, the process of the transmitting end sending the multiple transmission data to the receiving end via the multiple transmission channels includes:

[0025] In response to the multiple sending channels including multiple exclusive sending channels, the sending end simultaneously establishes first threads for each of the multiple exclusive sending channels, and uses the first threads to send the multiple transmission data in parallel to the receiving end;

[0026] In response to the multiple sending channels including multiple non-exclusive sending channels, each of the non-exclusive sending channels includes multiple first sockets for sending transmission data and multiple second sockets for sending other data; the sending end maximizes the bandwidth occupied by the multiple first sockets and minimizes the bandwidth occupied by the multiple second sockets; obtains the number of the multiple first sockets; based on the number of the multiple first sockets, the transmission data to be sent by the non-exclusive sending channel is sliced ​​to obtain multiple sliced ​​data, wherein the number of sliced ​​data is the same as the number of first sockets; and at the same time, a second thread is established for each of the multiple first sockets, and the multiple sliced ​​data are sent to the receiving end in parallel using the second thread.

[0027] Furthermore, the key information includes encryption key information of a first encryption key and verification key information of a verification key, and the process of the receiving end verifying the plurality of transmission data includes:

[0028] The multiple transmission data include first transmission data, and the receiving end parses the encryption key information and the verification key information from the key information;

[0029] The receiving end obtains a first decryption key corresponding to the first encryption key from the total decryption key pool according to the encryption key information, and obtains a verification key corresponding to the verification key from the total decryption key pool according to the verification key information;

[0030] The receiving end decrypts the ciphertext payload using the first decryption key to obtain a plaintext payload;

[0031] The receiving end concatenates the data block number of the first data block, the size of the first data block, the encryption key information, and the plaintext payload into a second file;

[0032] The receiving end performs an XOR operation on the verification key and the second file to obtain a verification value; and

[0033] The receiving end compares the verification value and the check value.

[0034] Further, the process of recovering the data to be sent by the receiving end based on the plurality of transmission data comprises:

[0035] The receiving end sorts the plurality of transmission data in order based on the data block number in the transmission data.

[0036] The application also proposes a multi-channel-based data secure transmission system, which is used to execute the above-mentioned multi-channel-based data secure transmission method, and comprises a sending end and a receiving end, wherein,

[0037] The sending end comprises at least a first key module configured with a total encryption key pool and a first communication module configured with a plurality of sending channels, and the receiving end comprises at least a second key module configured with a total decryption key pool and a second communication module configured with a plurality of receiving channels, the total encryption key pool and the total decryption key pool are the same, and the plurality of sending channels and the plurality of receiving channels correspond to each other; the first key module and the first communication module are connected through an encryption module, and the second key module and the second communication module are connected through a decryption module;

[0038] The first key module is used to provide the sending end with encryption keys and check keys, the first communication module is used to provide sending channels for data transmission to send data of the sending end to the receiving end, and the encryption module is used to execute encryption operation or XOR calculation;

[0039] The second key module is used to provide the receiving end with decryption keys and verification keys, the second communication module is used to provide receiving channels for data transmission to receive data sent from the sending end, and the decryption module is used to execute decryption operation or XOR calculation.

[0040] Further, the sending end further comprises a data source module, a transmission capacity acquisition module, a data splitting module, and a data processing module;

[0041] The data splitting module is connected with the data source module, the transmission capacity acquisition module, the data processing module, and the encryption module respectively; the transmission capacity acquisition module is further connected with the first communication module; and the data processing module is connected with the encryption module and the first communication module;

[0042] The data source module is used to store data to be sent;

[0043] The transmission capacity acquisition module is used to acquire transmission capacity of each of the plurality of sending channels in the first communication module; and

[0044] The data splitting module is used to split the data to be sent according to the transmission capacity.

[0045] The data processing module is configured to generate transmission data.

[0046] Further, the receiving end further comprises a data recovery module and a verification module.

[0047] The verification module is connected with the decryption module and the data recovery module.

[0048] The verification module is configured to verify the transmission data.

[0049] The data recovery module is configured to recover the data in sequence according to the data block number.

[0050] Advantages: the data security transmission method based on multiple channels provided by the present application, the sending end splits the data to be sent according to the sending capacity of each sending channel, which relieves the load pressure of each sending channel. In addition, the sending end generates transmission data in each sending channel in a certain data encoding format, and through the transmission of ciphertext and key information, the leakage of plaintext and key content is avoided, which effectively ensures the security in the transmission process. Thirdly, the receiving end can verify the integrity of the transmission file by using the check value, and it is very simple and easy to obtain the check value by using the exclusive or operation. The encryption operation and the exclusive or operation in the present application are both one-time pad, and this encryption method is absolutely secure, which guarantees the security of data transmission. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0052] Figure 1 It is a schematic diagram of the data security transmission system based on multiple channels of the present application.

[0053] Figure 2 It is a structural schematic diagram of the sending end of the present application.

[0054] Figure 3 It is a structural schematic diagram of the receiving end of the present application.

[0055] Figure 4 It is a flowchart of the data security transmission method based on multiple channels of the present application.

[0056] Figure 5 It is a schematic diagram of the data encoding format to which the transmission data of the present application conforms.

[0057] Figure 6 A schematic diagram of data block numbering according to the present invention. DETAILED DESCRIPTION

[0058] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0059] The present application proposes a multi-channel data security transmission method. Figure 1 The system shown in is executed.

[0060] like Figure 1 As shown, the present application proposes a multi-channel data security transmission system including a transmitting end for sending data and a receiving end for receiving data. The transmitting end should at least include a total encryption key pool for providing keys, and multiple transmitting channels for transmitting data, where the transmitting channels include a first transmitting channel, a second transmitting channel, a third transmitting channel, etc. Correspondingly, the receiving end should at least include a total decryption key pool for providing keys, and multiple receiving channels for receiving data, where the receiving channels include a first receiving channel, a second receiving channel, a third receiving channel, etc. The first transmitting channel corresponds to the first receiving channel, the second transmitting channel corresponds to the second receiving channel, the third transmitting channel corresponds to the third receiving channel, and so on. The total encryption key pool corresponds to the total decryption key pool, that is, the same key file is configured in both.

[0061] Specifically, the structure of the sending end in this application is as follows: Figure 2 shown.

[0062] The transmitting end includes a data source module, a transmission capability acquisition module, a data splitting module, an encryption module, a data processing module, a first key module, and a first communication module. The overall encryption key pool is deployed in the first key module, and multiple transmission channels, such as the first transmission channel, the second transmission channel, and the third transmission channel, are deployed in the first communication module. The transmission channels can be in the form of network ports, Bluetooth interfaces, USB interfaces, serial ports, and the like.

[0063] In the sending end, the data splitting module is connected to the data source module, the transmission capability acquisition module, the data processing module and the encryption module respectively; the transmission capability acquisition module is also connected to the first communication module; the encryption module is also connected to the first key module and the data processing module respectively; the data processing module is also connected to the first communication module.

[0064] In the sending end, a data source module is configured to store data to be sent; a transmission capacity obtaining module is configured to obtain transmission capacity of each of a plurality of sending channels in a first communication module; a data splitting module is configured to split the data to be sent according to the transmission capacity of each sending channel obtained by the transmission capacity obtaining module; a first key module is configured to provide encryption keys and verification keys for the sending end; the first communication module is configured to provide sending channels for data transmission, so as to send the split data to be sent to a receiving end; an encryption module is configured to perform encryption operation or XOR calculation; and a data processing module is configured to generate transmission data.

[0065] To better correspond the encryption keys provided by the total encryption key pool to the data transmitted by the sending channels, the first key module can further include a first sub-encryption key pool, a second sub-encryption key pool, a third sub-encryption key pool, and a plurality of sub-encryption key pools connected with the total encryption key pool. The number of the sub-encryption key pools is consistent with the number of the sending channels in the first communication module, and each sub-encryption key pool corresponds to one sending channel. The keys stored in the first sub-encryption key pool are used to encrypt the data to be sent by the first sending channel; the keys stored in the second sub-encryption key pool are used to encrypt the data to be sent by the second sending channel; and so on.

[0066] The structure of the receiving end in the present application is shown in Figure 3

[0067] The receiving end includes a data recovery module, a verification module, a decryption module, a second key module, and a second communication module. The total decryption key pool is disposed in the second key module, and the first receiving channel, the second receiving channel, the third receiving channel, and a plurality of receiving channels are disposed in the second communication module. The receiving channels can be in the form of a network port, a Bluetooth interface, a USB interface, a serial port, and the like, and correspond to the sending channels of the sending end.

[0068] In the receiving end, the decryption module is connected with the verification module, the second communication module, and the second key module respectively, and the verification module is further connected with the data recovery module. The second key module is configured to provide decryption keys and verification keys for the receiving end; the second communication module is configured to provide receiving channels for data transmission, so as to receive the data sent from the sending end; the decryption module is configured to perform decryption operation or XOR calculation; and the data recovery module is configured to recover the data received through the receiving channels in sequence, to obtain complete received data.

[0069] ​To better make the decryption keys provided by the total decryption key pool correspond to the data received by each receiving channel, the second key module can further include a first sub-decryption key pool, a second sub-decryption key pool, a third sub-decryption key pool, and the like, which are connected with the total decryption key pool. The number of sub-decryption key pools is consistent with the number of receiving channels in the second communication module and corresponds one-to-one. The keys stored in the first sub-decryption key pool are used to decrypt the data received by the first receiving channel; the keys stored in the second sub-decryption key pool are used to decrypt the data received by the second receiving channel, and so on.

[0070] For the above-mentioned multi-channel-based data security transmission system, the present application further proposes a multi-channel-based data security transmission method executed by the above-mentioned system, and the process of the method is as shown in Figure 4

[0071] The sending end obtains the transmission capacity of each of the plurality of sending channels.

[0072] This step is executed by the transmission capacity obtaining module of the sending end. The transmission capacity obtaining module obtains the first transmission capacity of the first sending channel, the second transmission capacity of the second sending channel, and so on, until the transmission capacity obtaining module obtains the transmission capacity of all sending channels in the first communication module. The transmission capacity of the sending channel can be known according to the physical characteristics; or in the actual application scenario, the user can test the sending limit of the sending channel by sending test data, thereby obtaining the transmission capacity. The transmission capacity here refers to the maximum data size that the sending channel can send.

[0073] The sending end splits the data to be sent into a plurality of data blocks according to the transmission capacity of each sending channel, and the size of each of the plurality of data blocks corresponds to the transmission capacity of each of the plurality of sending channels.

[0074] ​This step is performed by the data splitting module in the sending end. The data splitting module obtains the data to be sent from the data source module, and learns the transmission capacity of each sending channel from the transmission capacity acquisition module, and then splits the data to be sent according to the transmission capacity of each sending channel. The data splitting module can split the data to be sent into a first data block, a second data block, and so on. Among them, the size of the first data block corresponds to the transmission capacity of the first sending channel, the size of the second data block corresponds to the transmission capacity of the second sending channel, and so on. Here, the correspondence can mean that the size of the data block is equal to the transmission capacity of the sending channel, or the size of the data block is proportionally reduced to the transmission capacity of the sending channel. For example, to send a 3GB data file, the transmission capacity of the first sending channel is 1GB / s, and the transmission capacity of the second sending channel is 2GB / s. Then, the data splitting module can split the data to be transmitted into a first data block of 1GB and a second data block of 2GB. Or, there is a third sending channel with a transmission capacity of 2GB / s, and in the case of participating in transmission, the data splitting module can split the data to be transmitted into a first data block of 0.6GB, a second data block of 1.2GB, and a third data block of 1.2GB.

[0075] The sending end obtains a plurality of encryption keys from the total encryption key pool according to the size of each data block, and the length of each of the plurality of encryption keys is equal to the size of each corresponding data block.

[0076] This step is performed by the encryption module. The encryption module obtains encryption keys of the same length from the first key module according to the size of each data block obtained from the data splitting module, to perform 1:1 encryption operation on the data block using the encryption key. Here, the encryption key can be directly obtained from the total encryption key pool, or the encryption key can be first stored in the corresponding sub-encryption key pool by the total encryption key pool, and then the encryption key is obtained from the sub-encryption key pool by the encryption module. For example, the total encryption key pool can store the first encryption key for encrypting the first data block in the first sub-encryption key pool, and the encryption module obtains the first encryption key from the first sub-encryption key pool to perform the encryption operation. Here, the plurality of sub-encryption key pools can be physically deployed key storage units, or can be logically stored key storage units.

[0077] The sending end uses the plurality of encryption keys to encrypt each data block to generate a plurality of transmission data.

[0078] The encryption process in this step is performed by the encryption module, and the process of generating multiple transmission data is performed by the data processing module. These transmission data are transmitted in respective sending channels. For example, the first transmission data generated based on the first data block will be transmitted by the first sending channel, and the second transmission data generated based on the second data block will be transmitted by the second sending channel.

[0079] In some embodiments, the transmission data generated by the data processing module is data in a data encoding format, which includes, as shown in Figure 5 , a sending channel number, a data block number, a data block size, key information, a ciphertext payload, and a check value. Taking the first transmission data as an example, the ciphertext payload in the first transmission data is the ciphertext obtained by encrypting the first data block using the first encryption key.

[0080] Based on the above data encoding format, taking the first data block obtained by sending splitting as an example, the process of generating the first transmission data based on the first data block by the data processing module in the sending end includes:

[0081] The data processing module in the sending end records the sending channel number as the basis for splitting the first data block, the size of the first data block, and the encryption key information of the first encryption key. For the first data block, the sending channel number here is 1, representing the first sending channel. The encryption key information of the first encryption key includes the starting key position and the key length of the first encryption key in the key file of the total encryption key pool. The complete encryption key needs to be applied to the key file with the starting key position and key length information to obtain. Since only the position information and length information of the key are in the data encoding format, and the information of the key file is not included, such information will not expose the encryption key during transmission, ensuring the security of the key.

[0082] When the data splitting module in the sending end performs data splitting, it numbers the split data blocks according to their positional relationship in the data to be sent. For example, the position of the first data block can be the data block at the starting position of the data to be sent, as shown in Figure 6 , so the number of the first data block is 1. The data processing module can obtain the number of the data block from the data splitting module.

[0083] The data processing module of the sending end calculates the check value. The check value serves as a reference value for the receiving party to verify the integrity of the received data. In some embodiments, the process of calculating the check value by the data processing module of the sending end includes:

[0084] The data processing module splices the data block number of the first data block, the size of the first data block, the encryption key information of the first encryption key, and the content of the first data block into a first file; wherein the data block number of the first data block, the size of the first data block, and the content of the first data block are obtained from the data splitting module, and the encryption key information of the first encryption key is obtained from the encryption module.

[0085] The data processing module calculates the length of the first file.

[0086] The data processing module sends the first file and the length of the first file to the encryption module, and the encryption module obtains a check key equal in length to the length of the first file from the total encryption key pool of the first key module according to the length of the first file. The check key can also be stored in the first sub-encryption key pool from the total encryption key pool, and then taken out from the first sub-encryption key pool by the encryption module. The key information of the check key is also stored in the key information in the data encoding format.

[0087] The encryption module performs an exclusive or operation on the first file using the check key, and feeds back the result of the exclusive or operation to the data processing module, and the data processing module takes the received result of the exclusive or operation as a check value.

[0088] After the above operations, the data processing module can generate first transmission data for the first sending channel, and generate second transmission data for the second sending channel.

[0089] The sending end sends the plurality of transmission data to the receiving end via the plurality of sending channels.

[0090] In some embodiments, the sending channel can include an exclusive sending channel, i.e., the sending channel will only send one kind of data. For example, all sending capabilities of the first sending channel are used to send the first transmission data; all sending capabilities of the second sending channel are used to send the second transmission data.

[0091] In response to the plurality of sending channels including a plurality of exclusive sending channels, the sending end simultaneously establishes a first thread for each of the plurality of exclusive sending channels, and uses the first thread to send the plurality of transmission data to the receiving end in parallel. For example, the system of the sending end establishes a thread for the first sending channel at the same time as establishing a thread for the second sending channel, and the two threads can perform data transmission operations in parallel. In this way, the transmission process of the first transmission data via the first sending channel and the transmission process of the second transmission data via the second sending channel are performed in parallel, improving the data transmission efficiency.

[0092] In some embodiments, the sending channel can include a non-exclusive sending channel, i.e., the sending channel can send multiple types of data. For example, the third sending channel uses only part of the sending capacity to send the third transmission data, and the remaining sending capacity is used to transmit other data.

[0093] In response to the multiple sending channels including multiple non-exclusive sending channels, each of the non-exclusive sending channels including multiple first sockets for sending transmission data and multiple second sockets for sending other data. At this time, the system of the sending end maximizes the bandwidth occupied by the multiple first sockets and minimizes the bandwidth occupied by the multiple second sockets. This can be achieved by increasing the number of first sockets or by the system directly adjusting the bandwidth occupied by each first socket and each second socket. Ultimately, the first sockets maximize the sending capacity of the sending channel. The data processing module obtains the number of first sockets adjusted by the system. The data processing module fragments the transmission data to be sent by the non-exclusive sending channel based on the obtained number of first sockets to obtain multiple fragmented data, wherein the number of fragmented data is the same as the number of first sockets. For example, the data processing module fragments the third transmission data based on the number of first sockets in the third sending channel according to the sending capacity of each first socket. The system of the sending end simultaneously establishes a second thread for each of the multiple first sockets, and uses the second thread to send the multiple fragmented data to the receiving end in parallel.

[0094] In yet some embodiments, the sending channel includes both exclusive sending channels and non-exclusive sending channels. In this case, the exclusive sending channels use the data transmission method described above for exclusive sending channels, and the non-exclusive sending channels use the data transmission method described above for non-exclusive sending channels.

[0095] The receiving end receives and verifies multiple transmission data. The multiple transmission data include the first transmission data, which is data sent by the first sending channel of the sending end and received by the first receiving channel of the receiving end. This step is performed by the decryption module and the verification module. Taking the receiving end receiving and verifying the first transmission data as an example, the process of the receiving end verifying the first transmission data includes:

[0096] The decryption module of the receiving end parses the encryption key information of the first encryption key and the verification key information of the verification key from the key information of the received first transmission data.

[0097] The decryption module of the receiving end obtains the first decryption key corresponding to the first encryption key from the total decryption key pool in the second key module according to the first encryption key information, and obtains the verification key corresponding to the verification key from the total decryption key pool in the second key module according to the verification key information. The first decryption key and the verification key here can be directly obtained from the total decryption key pool, or the first decryption key can be first stored in the corresponding first sub-decryption key pool by the total decryption key pool, and then the first decryption key is obtained from the first sub-decryption key pool by the decryption module. The plurality of sub-decryption key pools here can be physically deployed key storage units, or can be logically stored key storage units.

[0098] The decryption module of the receiving end uses the first decryption key to decrypt the ciphertext load of the first transmission data to obtain the plaintext load.

[0099] The verification module of the receiving end obtains the data block number of the first data block, the size of the first data block, and the first encryption key information from the received first transmission data, splices the obtained data block number of the first data block, the size of the first data block, and the first encryption key information and the plaintext load obtained by the decryption module in the last step to obtain a second file. The verification module sends the second file to the decryption module.

[0100] The decryption module of the receiving end uses the verification key to perform an exclusive or operation with the received second file to obtain a verification value. The decryption module sends the verification value to the verification module.

[0101] The verification module of the receiving end compares the verification value obtained from the decryption module and the verification value parsed from the first transmission file. If the verification value and the verification value are consistent, the verification of the first transmission file is passed, indicating that the first transmission file is not tampered with in the transmission process; if the verification value and the verification value are inconsistent, the verification of the first transmission file is not passed, indicating that the received first transmission file is inconsistent with the sent first transmission file, and the receiving end discards the first transmission file and feeds back to the sending end, requesting the sending end to resend the first transmission file.

[0102] Similarly, for the second transmission file sent through the second sending channel and received through the second receiving channel, the third transmission file sent through the third sending channel and received through the third receiving channel, and the like, the receiving end adopts the above method for verification.

[0103] After the verification, the receiving end restores the data to be sent based on the transmission data. This step is performed by the data restoration module. The process of restoration includes: the data restoration module of the receiving end sorts multiple transmission data in order based on the data block number in the transmission data. For example, the data restoration module obtains the number 1 of the first data block and the content of the first data block from the first transmission data, and obtains the number 2 of the second data block and the content of the second data block from the second transmission data. According to the number, the content of the first data block is placed before the content of the second data block, and the sorting is completed. The sorting method of other data blocks is similar.

[0104] Through the data security transmission method based on multiple channels provided in the application, the sending end splits the data to be sent according to the sending capacity of each sending channel, thereby relieving the load pressure of each sending channel in sending data. In addition, the sending end generates transmission data in each sending channel in a certain data encoding format, avoids leakage of plaintext and leakage of key content through transmission of ciphertext and key information, and effectively ensures the security in the transmission process. Thirdly, the receiving end can verify the integrity of the transmission file by using the check value, and it is very simple and easy to obtain the check value by using the exclusive or operation. The encryption operation and the exclusive or operation in the application are both one-time pad, and this encryption method is absolutely secure, thereby ensuring the security of data transmission.

Claims

1. A multi-channel based data secure transmission method, characterized in that, The total encryption key pool preset in the sending end participating in the data secure transmission method and the total decryption key pool preset in the receiving end are the same, the sending end is provided with a plurality of sending channels, the receiving end is provided with a plurality of receiving channels, the plurality of sending channels and the plurality of receiving channels correspond to each other, and the method comprises: The sending end acquires the transmission capacity of each of the plurality of sending channels; The sending end splits the data to be sent into a plurality of data blocks according to the transmission capacity of each sending channel, the size of each of the plurality of data blocks corresponds to the transmission capacity of each of the plurality of sending channels; The sending end acquires a plurality of encryption keys from the total encryption key pool according to the size of each data block, the length of each of the plurality of encryption keys is equal to the size of the corresponding each data block; The sending end encrypts each data block using the plurality of encryption keys to generate a plurality of transmission data; The sending end sends the plurality of transmission data to the receiving end via the plurality of sending channels; The receiving end receives and verifies the plurality of transmission data; and After verification, the receiving end restores the data to be sent based on the plurality of transmission data; The transmission data is data with a data encoding format, and the data encoding format comprises: sending channel number, data block number, data block size, key information, ciphertext payload, and check value. The plurality of data blocks comprise a first data block, the plurality of encryption keys comprise a first encryption key for encrypting the first data block, and the process of the sending end generating transmission data comprises: The sending end records the sending channel number as the basis for splitting the first data block, the size of the first data block, and the encryption key information of the first encryption key; The sending end generates the data block number of the first data block according to the position of the first data block in the data to be sent; and The sending end calculates the check value; The process of the sending end calculating the check value comprises: The sending end splices the data block number of the first data block, the size of the first data block, the encryption key information of the first encryption key, and the content of the first data block into a first file; The sending end calculates the length of the first file; The sending end acquires a check key of the same length from the total encryption key pool according to the length of the first file; and The sending end performs an exclusive or operation on the check key and the first file to obtain the check value.

2. The method of claim 1, wherein, The process of the sending end sending the plurality of transmission data to the receiving end via the plurality of sending channels comprises: In response to the plurality of sending channels comprising a plurality of exclusive sending channels, the sending end simultaneously establishes a first thread for each of the plurality of exclusive sending channels, and uses the first thread to send the plurality of transmission data to the receiving end in parallel. In response to the multiple sending channels including multiple non-exclusive sending channels, each of the non-exclusive sending channels includes multiple first sockets for sending transmission data and multiple second sockets for sending other data; the sending end maximizes bandwidth occupied by the multiple first sockets and minimizes bandwidth occupied by the multiple second sockets; the number of the multiple first sockets is obtained; transmission data to be sent by the non-exclusive sending channel is fragmented based on the number of the multiple first sockets to obtain multiple fragmented data, wherein the number of the fragmented data is the same as the number of the first sockets; and the multiple first sockets are simultaneously established with second threads respectively, and the multiple fragmented data are sent to the receiving end in parallel using the second threads.

3. The method of claim 1, wherein, The key information includes encryption key information of a first encryption key and verification key information of a verification key, and the process of verifying the multiple transmission data by the receiving end includes: The multiple transmission data include first transmission data, and the receiving end parses the encryption key information and the verification key information from the key information; The receiving end obtains a first decryption key corresponding to the first encryption key from the total decryption key pool according to the encryption key information and obtains a verification key corresponding to the verification key from the total decryption key pool according to the verification key information; The receiving end decrypts the ciphertext payload using the first decryption key to obtain plaintext payload; The receiving end concatenates the data block number of the first data block, the size of the first data block, the encryption key information and the plaintext payload into a second file; The receiving end performs an exclusive or operation on the second file using the verification key to obtain a verification value; and The receiving end compares the verification value with the verification value.

4. The method of claim 1, wherein, The process of restoring the data to be sent by the receiving end based on the multiple transmission data includes: The receiving end sorts the multiple transmission data in order based on the data block numbers in the transmission data.

5. A multi-channel based data security transmission system, characterized in that, The system is used to execute the multi-channel-based data security transmission method in any one of claims 1-4, and the system includes a sending end and a receiving end, wherein The sending end at least includes a first key module configured with a total encryption key pool and a first communication module configured with multiple sending channels, the receiving end at least includes a second key module configured with a total decryption key pool and a second communication module configured with multiple receiving channels, the total encryption key pool and the total decryption key pool are the same, and the multiple sending channels and the multiple receiving channels correspond to each other; the first key module and the first communication module are connected through an encryption module, and the second key module and the second communication module are connected through a decryption module; The first key module is used to provide encryption keys and verification keys for the sending end, the first communication module is used to provide sending channels for data transmission to send data of the sending end to the receiving end, and the encryption module is used to perform encryption operation or exclusive or calculation; The second key module is configured to provide a decryption key and a verification key for the receiving end, the second communication module is configured to provide a receiving channel for data transmission to receive data sent from the sending end, and the decryption module is configured to perform a decryption operation or an exclusive or calculation.

6. The multi-lane based data secure transmission system according to claim 5, wherein, The sending end further comprises a data source module, a transmission capacity acquisition module, a data splitting module, and a data processing module. The data splitting module is connected with the data source module, the transmission capacity acquisition module, the data processing module, and the encryption module respectively; the transmission capacity acquisition module is further connected with the first communication module; and the data processing module is connected with the encryption module and the first communication module. The data source module is configured to store data to be sent. The transmission capacity acquisition module is configured to acquire the transmission capacity of each of the plurality of sending channels in the first communication module; and The data splitting module is configured to split the data to be sent according to the transmission capacity. The data processing module is configured to generate transmission data.

7. A multi-lane based data secure transmission system according to claim 5 or 6, wherein, The receiving end further comprises a data restoration module and a verification module. The verification module is connected with the decryption module and the data restoration module. The verification module is configured to verify transmission data. The data restoration module is configured to restore data in sequence according to data block numbers.

Images